Overview

overview

10

Static

static

10

0938a2044b...c2.exe

windows7_x64

10

0938a2044b...c2.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0938a2044bcefaf291d384599cc2199fad3a0ec0039820cf6cb7016fd7db20c2

  • Size

    80KB

  • Sample

    220212-lpxjxaagc4

  • MD5

    279cd7e171ad311a44ab791c77598074

  • SHA1

    2792820b5ee41193fb88848f58bb944a66471fe2

  • SHA256

    0938a2044bcefaf291d384599cc2199fad3a0ec0039820cf6cb7016fd7db20c2

  • SHA512

    e0ee88208d06a82768203274b6a3a572a86ca32f31de67c982bcb454886d4934fe51f829bbfd443eae9304558fcbdc3da4518f92ba8e3e0bb7709995c34fb635

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      0938a2044bcefaf291d384599cc2199fad3a0ec0039820cf6cb7016fd7db20c2

    • Size

      80KB

    • MD5

      279cd7e171ad311a44ab791c77598074

    • SHA1

      2792820b5ee41193fb88848f58bb944a66471fe2

    • SHA256

      0938a2044bcefaf291d384599cc2199fad3a0ec0039820cf6cb7016fd7db20c2

    • SHA512

      e0ee88208d06a82768203274b6a3a572a86ca32f31de67c982bcb454886d4934fe51f829bbfd443eae9304558fcbdc3da4518f92ba8e3e0bb7709995c34fb635

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks